How to fix Disconnecting: Too many authentication failures in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 327 views

This error occurs when an SSH client (or server) exceeds the maximum number of authentication attempts. The SSH daemon disconnects the connection to prevent brute force attacks and excessive failed login attempts.

Quick fix

Fixes Disconnecting: Too many authentication failures

ssh -i ~/.ssh/correct_key.pem user@hostname
  1. Specify the exact SSH key to use
  2. Configure your SSH config file with IdentitiesOnly
  3. Clean up your SSH agent if too many keys are loaded
  4. Disable public key authentication if using password
ssh — error
ssh -i ~/.ssh/correct_key.pem user@hostname
Disconnecting: Too many authentication failures

What this error means

When the SSH daemon (sshd) receives too many failed authentication attempts from a client connection, it disconnects to protect the server from brute force attacks. The server counts each authentication method attempt (publickey, password, keyboard-interactive, etc.) toward the MaxAuthTries limit. Once the threshold is reached, the server forcibly closes the connection. This is a security feature designed to block automated attack attempts and prevent attackers from repeatedly trying invalid credentials.

Typical symptoms

  • Connection is abruptly closed with message 'Disconnecting: Too many authentication failures'
  • SSH command-line client shows error after multiple failed login attempts
  • Server appears to refuse further connection attempts after repeated failed tries
  • CI/CD pipelines fail with authentication error and disconnect immediately
  • SSH client hangs and then closes after trying multiple keys from ssh-agent
  • Manual SSH connection attempts fail when using multiple identity files

Common causes

  1. SSH client has many keys loaded in ssh-agent and tries each one, exceeding the server's MaxAuthTries limit (default is usually 6 per connection)
  2. Wrong password entered multiple times before the connection closes
  3. SSH key offered doesn't match any authorized_keys entry and other keys are then tried
  4. Client is configured to try multiple IdentityFile entries, each counting as one attempt
  5. Stale or incorrect SSH configuration offering too many identity files
  6. SSH agent forwarding is enabled with many keys available and the server tries all of them
  7. Attacking or misconfigured client repeatedly attempting to authenticate with invalid keys

How to fix "Disconnecting: Too many authentication failures"

1Specify the exact SSH key to use

The most effective fix is to tell SSH to use a specific key file, bypassing the ssh-agent:

bash
ssh -i ~/.ssh/correct_key.pem user@hostname

This avoids trying multiple keys and ensures only the correct key is sent in the first attempt. Replace correct_key.pem with your actual key filename.

2Configure your SSH config file with IdentitiesOnly

Add a Host section to ~/.ssh/config that specifies exactly which key to use and prevents offering others:

bash
Host myserver
    HostName example.com
    User myuser
    IdentityFile ~/.ssh/correct_key.pem
    IdentitiesOnly yes
    ConnectTimeout 10

The critical setting is IdentitiesOnly yes, which tells SSH to only use the specified IdentityFile and ignore all keys in ssh-agent. Now connect simply with:

bash
ssh myserver
3Clean up your SSH agent if too many keys are loaded

If you have many keys loaded in ssh-agent, you can temporarily remove all of them and add back only the one you need:

bash
# Remove all keys from the agent
ssh-add -D

# Add only the key you need
ssh-add ~/.ssh/correct_key.pem

You'll be prompted for the key's passphrase (if it has one). After this, SSH will only offer that single key when connecting, avoiding the MaxAuthTries limit.

To see what keys are currently loaded:

bash
ssh-add -l
4Disable public key authentication if using password

If you're trying to log in with a password instead of a key, you can skip the publickey attempts entirely:

bash
ssh -o PubkeyAuthentication=no user@hostname

This forces password authentication and avoids the client offering keys that don't match. You'll be prompted for the password instead.

Add this to your SSH config if you want it to persist:

bash
Host myserver
    HostName example.com
    PubkeyAuthentication no
5Verify your key matches the server's authorized_keys

Make sure the public key on your client matches what's configured on the server:

On your client machine, display your public key:

bash
cat ~/.ssh/correct_key.pub

Then, log into the server (or ask the administrator) and check if your public key is in ~/.ssh/authorized_keys:

bash
grep "YOUR_PUBLIC_KEY_CONTENT" ~/.ssh/authorized_keys

If it's not there, you need to add it to the server's authorized_keys file:

bash
echo "your-public-key-content" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
6Use SSH verbose mode to debug what's happening

Add -v flags to SSH to see detailed debug output about which keys are being tried:

bash
ssh -v user@hostname

For even more detail:

bash
ssh -vv user@hostname
ssh -vvv user@hostname

Look for lines like:

bash
Trying private key: /home/user/.ssh/id_rsa
Trying private key: /home/user/.ssh/id_ed25519
Trying private key: /home/user/.ssh/id_ecdsa

This shows which keys are being attempted in what order. If you see many attempts and then "Disconnecting: Too many authentication failures", you know the issue is too many keys being tried.

7Server-side: Increase MaxAuthTries (if you control the server)

If you're the server administrator and need to allow more authentication attempts, edit /etc/ssh/sshd_config:

bash
sudo nano /etc/ssh/sshd_config

Find the line MaxAuthTries (it may be commented out with #) and change it:

bash
MaxAuthTries 10

Then restart the SSH daemon:

bash
sudo systemctl restart sshd

Warning: Increasing this setting makes your server slightly more vulnerable to brute force attacks. Only do this if you have a specific reason (e.g., many automated keys being offered) and preferably combined with other security measures like disabling password authentication and using firewall rules.

Advanced notes

Advanced troubleshooting:

Per-Connection Reset: MaxAuthTries is enforced per SSH connection, not globally. Each new connection resets the attempt counter. If you're testing multiple keys, you'll hit the limit per connection, not across all connection attempts.

SSH Agent Behavior: When using SSH agent forwarding or a local agent with many keys, the client automatically tries each key until one works or the limit is reached. The best practice is to use IdentitiesOnly yes with explicit IdentityFile entries in your SSH config to be explicit about which keys to try.

CI/CD Systems: In continuous integration pipelines (GitHub Actions, GitLab CI, Jenkins, etc.), if using SSH keys for git operations, configure the pipeline to use a specific key file rather than relying on ssh-agent defaults. Many CI systems have ways to inject SSH keys; read your platform's SSH documentation.

Kubernetes and Container SSH: When running SSH inside containers or Kubernetes pods, ensure the ssh-agent isn't trying to forward many keys. Prefer explicit key passing via environment variables or mounted secrets.

Older OpenSSH Versions: Very old SSH versions (pre-7.0) had different key exchange behavior and MaxAuthTries counting. If upgrading is possible, newer versions have more predictable behavior.

Frequently asked questions

What does "Disconnecting: Too many authentication failures" mean?
When the SSH daemon (sshd) receives too many failed authentication attempts from a client connection, it disconnects to protect the server from brute force attacks. ) toward the MaxAuthTries limit. Once the threshold is reached, the server forcibly closes the connection.
How do I fix "Disconnecting: Too many authentication failures"?
This error occurs when an SSH client (or server) exceeds the maximum number of authentication attempts. The SSH daemon disconnects the connection to prevent brute force attacks and excessive failed login attempts.
What causes "Disconnecting: Too many authentication failures"?
SSH client has many keys loaded in ssh-agent and tries each one, exceeding the server's MaxAuthTries limit (default is usually 6 per connection) Wrong password entered multiple times before the connection closes SSH key offered doesn't match any authorized_keys entry and other keys are then tried
Is the "Disconnecting: Too many authentication failures" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading